As discussed previously, in order to introduce new OS hardening defaults, we've added them to bsdinstall in 'off by default' mode. It has been there for a while, so the next step is to change them to 'on by defaul' mode, so that in future we could simply enable them in base OS. Reviewed by: brd Approved by: adrian Differential Revision: https://reviews.freebsd.org/D9641